# Ensure API Gateway REST APIs use a private endpoint

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292186643605-ensure-api-gateway-rest-apis-use-a-private-endpoint
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon API Gateway REST API uses the private endpoint type. A private REST API can only be called from your VPCs through an interface VPC endpoint (AWS PrivateLink), while edge-optimized and Regional REST APIs are reachable from the Internet.

**Rationale**

An API that is reachable from the Internet has a larger attack surface. Misconfigured or unauthenticated methods can leak data, unauthorized calls can change backend state, and bots or denial-of-service attacks can exhaust capacity and increase costs. Making internal APIs private keeps them off the Internet. If public access is required, the API should at least be restricted with a resource policy, protected with strong authentication (IAM, Amazon Cognito or Lambda authorizers), and covered by AWS WAF, throttling and logging.

**Impact**

-   Removes the API from the Internet, so it can only be reached from your VPCs through an interface VPC endpoint
    
-   Reduces exposure to data leaks, unauthorized calls and denial-of-service attacks
    
-   Clients outside your VPCs, including those using public custom domain names, will no longer be able to call the API
    

**Default Value**

New REST APIs created in the console use the **Regional** endpoint type, and REST APIs created with the API or AWS CLI without an endpoint configuration use the **edge-optimized** type. Both are publicly accessible. An API is private only if the **Private** endpoint type was explicitly selected.

**Pre-Requisites**

-   IAM permissions: apigateway:GET, apigateway:PATCH, apigateway:PUT and apigateway:POST (API Gateway administration)
    
-   An interface VPC endpoint for the execute-api service in each VPC that must call the API
    
-   A resource policy for the API that allows access from the required VPCs or VPC endpoints (private APIs cannot be invoked without one)
    
-   Confirmation from the application owner that no client needs to call the API from the Internet
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select **APIs** in the left menu.
    
3.  For each API of type **REST**, check the **API endpoint type** column (or the **API endpoint type** in the API's **API settings**).
    
4.  Repeat for each region in use.
    
5.  If any REST API has the endpoint type **Edge-optimized** or **Regional**, follow the implementation steps.
    

**CLI:**

List the REST APIs and their endpoint types:

aws apigateway get-rest-apis --region <REGION> --query "items\[\].\[name,id,endpointConfiguration.types\[0\]\]" --output table

A REST API fails if its endpoint type is anything other than PRIVATE (that is, EDGE or REGIONAL).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select the REST API.
    
3.  Select **Resource policy** and add a policy that allows access only from the required VPCs or VPC endpoints, then choose **Save changes**.
    
4.  Select **API settings** and choose **Edit** in **API details**.
    
5.  Set **API endpoint type** to **Private** and select the VPC endpoints that will call the API, if required.
    
6.  Choose **Save changes**.
    
7.  Select **Resources** and choose **Deploy API** to deploy the API to its stages so that the resource policy takes effect.
    
8.  Repeat for each public REST API in each region in use.
    

**CLI:**

Change the endpoint type to private. The path must name the current endpoint type (EDGE or REGIONAL) shown in the Test Plan output, not a list index:

aws apigateway update-rest-api --region <REGION> --rest-api-id <REST\_API\_ID> --patch-operations op=replace,path=/endpointConfiguration/types/REGIONAL,value=PRIVATE

Deploy the API to its stage so that the change and resource policy take effect:

aws apigateway create-deployment --region <REGION> --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME>

**Backout Plan**

Before making changes, save the current API settings:

aws apigateway get-rest-api --region <REGION> --rest-api-id <REST\_API\_ID> > rest-api-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console, select the REST API and select **API settings**.
    
3.  Choose **Edit** in **API details** and set **API endpoint type** to **Regional**.
    
4.  Choose **Save changes**.
    
5.  If needed, restore the previous resource policy from the saved backup and deploy the API again.
    

**CLI:**

aws apigateway update-rest-api --region <REGION> --rest-api-id <REST\_API\_ID> --patch-operations op=replace,path=/endpointConfiguration/types/PRIVATE,value=REGIONAL

Note: a private API can only be changed back to **Regional**, not directly to **Edge-optimized**. Rolling back makes the API reachable from the Internet again.

**Reference**

-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html)
    
-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-api-migration.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-api-migration.html)
    
-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-rest-api.html](https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-rest-api.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.